#!/bin/bash
PATH="/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin"
export LANG=zh_CN.UTF-8
export PATH

LOG_FILE=$2









# 统计状态码并排序
GroupByStatusCode(){
  awk  -F "|" '
    {
    Arry[$5] += 1; 
    total++;
    }
    END {
    for (s in Arry) {
        printf "%d\t%.4f\t%s\n", Arry[s], Arry[s] / total, s
    }
    }
    ' $LOG_FILE | sort -nr -k 1,1
}

# 统计IP并排序
GroupByRemoteAddress(){
    awk   -F "|"  '
    {
    Arry[$1] += 1;  
    total++;        
    }
    END {
    for (s in Arry) {  
        printf "%d\t%.4f\t%s\n", Arry[s], Arry[s] / total, s  
    }
    }
    ' $LOG_FILE | sort -nr -k 1,1
}

# 统计Referer并排序
GroupByReferer(){
    awk -F "|"  '
    {
    Arry[$4] += 1;  
    total++;        
    }
    END {
    for (s in Arry) {  
        printf "%d\t%.4f\t%s\n", Arry[s], Arry[s] / total, s  
    }
    }
    ' $LOG_FILE | sort -nr -k 1,1  # 按出现次数降序排序

}

# 统计User-Agent并排序
GroupByUserAgent(){
    awk  -F "|"  '
    {
    Arry[$8] += 1;  
    total++;        
    }
    END {
    for (s in Arry) {  
        printf "%d\t%.4f\t%s\n", Arry[s], Arry[s] / total, s  
    }
    }
    ' $LOG_FILE | sort -nr -k 1  
}

# 统计URI不含参数，并排序
GroupByUri(){
    awk  '
    {
    Arry[$9] += 1;  
    total++;        
    }
    END {
    for (s in Arry) {  
        printf "%d\t%.4f\t%s\n", Arry[s], Arry[s] / total, s  
    }
    }
    ' $LOG_FILE | sort -nr -k 1  
}

# 统计URL并排序
GroupByUrl(){
  cat $LOG_FILE | awk -F\" '{split($2, url, " "); Arry[url[2]]+=1; total++} END {for(s in Arry) {printf "%d\t%.4f\t%s\n", Arry[s], Arry[s]/total, s}}' | sort -nr -k 1
}

# 统计请求方法并排序
GroupByMethod(){
  cat $LOG_FILE |awk -F "|" '{split($4,aa," ");Arry[aa[2]]+=1;total++}END{for(s in Arry){printf "%d\t%.4f\t%s\n",Arry[s],Arry[s]/total,s}}'|sort -nr -k 1

}

# 统计请求时间并排序
GroupByRequestTime(){
  cat $LOG_FILE | awk -F\" '{split($14, time, " "); if(time[1]<1) {reqs["<1"]++} else if(time[1]>=1 && time[1]<5) {reqs["1-5"]++} else if(time[1]>=5 && time[1]<10) {reqs["5-10"]++} else {reqs[">10"]++}; total++} END {printf "<1\t%.4f\t%d\n1-5\t%.4f\t%d\n5-10\t%.4f\t%d\n>10\t%.4f\t%d\n", reqs["<1"]/total, reqs["<1"], reqs["1-5"]/total, reqs["1-5"], reqs["5-10"]/total, reqs["5-10"], reqs[">10"]/total, reqs[">10"]}'
}

# 统计每分钟请求的数量
TrendTimesCount(){
  cat $LOG_FILE | awk -F\" '{split($4, time, ":"); minute=time[2]":"time[3]; tms[minute]+=1} END {for(t in tms) print t" "tms[t]}'
}

# 统计每分钟的流量
TrendTimesNetFlow(){
  cat $LOG_FILE | awk '{split($4, time, ":"); minute=time[2]":"time[3]; tms[minute]+=$10} END {for(t in tms) printf "%s\t%.4fMB\n", t, tms[t]/1024/1024}'
}

# 统计每分钟的数量、流量、状态码分布、平均请求时间
TrendTimesAll(){
  cat $LOG_FILE | awk 'BEGIN {printf "时间\t数量\t流量[MB]\t请求时间\t20x\t30x\t40x\t50x\t60x\n"} {
    split($4, time, ":"); minute=time[2]":"time[3];
    tms[minute]+=$10; cnt[minute]+=1; reqt[minute]+=$14;
    if($9 ~ /^2/) {sc20x[minute]++}
    else if($9 ~ /^3/) {sc30x[minute]++}
    else if($9 ~ /^4/) {sc40x[minute]++}
    else if($9 ~ /^5/) {sc50x[minute]++}
    else {sc60x[minute]++};
  } END {
    for(t in tms) printf "%s\t%d\t%.4f\t%.4f\t%d\t%d\t%d\t%d\t%d\n", t, cnt[t], tms[t]/1024/1024, reqt[t]/cnt[t], sc20x[t], sc30x[t], sc40x[t], sc50x[t], sc60x[t]
  }'
}

# 帮助函数
Help(){
  echo "Help:"
  echo "\$1 args \$2 logfile"
  echo "s :groupby statuscode"
  echo "h :groupby remoteaddress"
  echo "e :groupby referer"
  echo "a :groupby useragent"
  echo "i :groupby uri"
  echo "r :groupby url"
  echo "t :groupby requestTime"
  echo "m :groupby method"
  echo "tc :trend count request by minute"
  echo "tn :trend count netflow by minute"
  echo "ta :trend count request, netflow, requestTime, statuscode by minute"
  echo "Usage Example:"
  echo "$0 s access.log"
  echo "$0 h access.log"
  echo "$0 i access.log"
  echo "$0 tn access.log"
  echo "$0 ta access.log"
}

# 参数检查
if [ $# -ne 2 ]; then
  Help
  exit 1
else
  if [ ! -s $LOG_FILE ]; then
    echo "$LOG_FILE file does not exist"
    exit 1
  fi
fi

# 功能选择
case $1 in
  s|statuscode)
    GroupByStatusCode;;
  h|remoteaddress)
    GroupByRemoteAddress;;
  e|referer)
    GroupByReferer;;
  a|useragent)
    GroupByUserAgent;;
  i|uri)
    GroupByUri;;
  r|url)
    GroupByUrl;;
  t|requesttime)
    GroupByRequestTime;;
  m|method)
    GroupByMethod;;
  tc|trendcount)
    TrendTimesCount;;
  tn|trendnet)
    TrendTimesNetFlow;;
  ta|trendall)
    TrendTimesAll;;
  *)
    Help;;
esac
